Privacy notice

Who operates SmileScale

SmileScale is operated by Lead Media AS, organization number 927 101 513, Sinsenveien 53E, 0585 Oslo, Norway.

Lead Media AS is responsible for data used to provide SmileScale accounts, billing, security, and the service itself. When you send an inquiry through a dental practice's SmileScale experience, that practice decides how to follow up and is generally responsible for the lead data. Lead Media AS handles that data to provide the service to the practice. The practice's own privacy notice also applies to its use of your inquiry.

Information we handle

• Practice account details, such as the account email, practice name, legal identity, notification and incident contacts, service settings, and subscription or complimentary-access status.
• Practice launch records, including the exact version and content of pilot documents acknowledged by an authenticated representative, their name, title, authority confirmation, timestamp, and related privacy, advertising, and release approvals.
• Lead details you choose to submit, such as your name, mobile number, email address when provided, inquiry choices, and versioned records of the permissions you give or withdraw.
• Limited technical and security data, including IP-derived abuse controls, request timing, and service error information scrubbed of contact details and image content.
• Payment and subscription references. Stripe processes payment card details; SmileScale does not store full card information.

Your photo and preview

The standard Whitening preview changes tooth color locally in your browser. Your photo is not uploaded to SmileScale or an image provider for that local preview.

To load the tool, face-landmark model, and public fonts, your browser may request version-pinned files directly from jsDelivr and Google. Those providers can receive ordinary network metadata such as your IP address, browser details, request time, and requested file. The request does not contain your photo, lead form, or chosen whitening level.

A practice may separately enable an AI smile makeover preview. If available, it is clearly identified and requires a separate, affirmative choice and consent before a photo is sent for AI processing. SmileScale does not use a local-preview failure as permission to upload your photo and does not persist the source or generated AI image. The selected AI provider processes the image only for that requested preview under its applicable data controls.

Both previews are illustrative. They are not a diagnosis, treatment plan, or promise of a dental result.

Why information is used

• To provide, secure, and maintain SmileScale.
• To deliver your inquiry to the practice you selected.
• To let that practice contact you by phone or email about the whitening inquiry you submitted.
• If you separately choose it, to let that practice send future whitening information and offers by email until you unsubscribe.
• To administer practice accounts, subscriptions, and support.
• To prevent abuse, investigate failures, and meet legal obligations.

Depending on the context, processing is based on providing the service or responding to your request, legitimate interests in a secure and reliable service, legal obligations, or your consent for optional promotional email, first-party funnel measurement, or AI image processing. You may withdraw consent for future processing without affecting earlier lawful processing.

Contact and email categories

• Practice service notifications tell an authorized practice user that a new lead or account event needs attention. They are part of operating SmileScale, not promotional email to the visitor.
• Inquiry follow-up lets the selected practice respond by phone or email to the whitening request you submitted. It may continue while that inquiry or resulting customer conversation remains active, but it is not blanket permission for unrelated offers.
• Promotional email is optional and requires a separate affirmative choice. You can unsubscribe at any time. The practice must record and honor the withdrawal, while keeping only the historical inquiry, suppression evidence, and conversion information that it may lawfully retain.

SmileScale does not currently run automated promotional-email sequences for practices. If that feature is added later, it must enforce the practice-specific permission and suppression record before any promotional message is sent.

Service providers and transfers

SmileScale uses specialist providers for hosting, database storage, authentication, billing, transactional email, realtime updates, and abuse prevention. These currently include Vercel, Neon, Clerk, Stripe, Resend, Pusher, Upstash, and Sentry. Version-pinned MediaPipe files are delivered by jsDelivr and Google for the local preview; your photo is not sent to either service. OpenAI is involved only when you select and consent to an enabled AI preview.

Some providers may process data outside Norway or the European Economic Area. Where required, Lead Media AS uses appropriate contractual and legal safeguards for those transfers.

Lead notification emails are generic and do not contain your contact details, whitening selections, or photo. The practice signs in to view the stored lead securely.

Retention and deletion

A submitted lead remains available while the practice has a documented purpose and lawful basis to use it, including responding to the inquiry, managing the resulting customer relationship, or an active marketing permission. SmileScale does not automatically delete an active lead solely because a fixed number of days has passed.

Withdrawing marketing permission stops future promotional email; it does not itself erase the historical inquiry or conversion record. A valid erasure request removes or de-identifies the person where required, while non-identifying campaign and conversion statistics may remain. Minimum consent and suppression evidence may also be retained where needed to demonstrate the request and prevent further marketing.

Account, billing, and security records are kept only as long as needed for the service, accounting, fraud prevention, or another applicable legal requirement.

Practice agreement and launch-readiness records may remain after a pilot ends where needed to document accepted terms, processing instructions, authority, security decisions, disputes, or legal compliance.

Cookies and measurement

SmileScale uses essential technology for authentication, security, and service operation. The pilot experience does not use session replay or third-party behavioral advertising trackers. Basic first-party measurement is optional. Before you enable it, the widget does not read or write a persistent browser identifier and sends no funnel events. If enabled, a practice-specific session ID is stored in session storage and versioned measurement evidence is sent with events. Those events exclude contact details and image content and support long-term funnel and campaign reporting.

Your rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, or an objection to processing. You may also complain to the Norwegian Data Protection Authority or another competent supervisory authority.

For an inquiry sent to a practice, contacting that practice directly is often the fastest route. You may also contact Lead Media AS at the address above or by email at privacy@smilescale.app. We may need to verify your identity before acting on a request.